chore(ci): add supply-chain minimum-release-age gate + Renovate onboarding

Onboards javascript-sdk to convertcom/supply-chain:
- renovate.json extends the shared preset (minimumReleaseAge 3d, @convertcom/*
  exempt, GitHub Action digest pinning)
- dep-age-check workflow runs the shared composite age gate on every PR
  (warn mode for the initial bake; will flip to block + required check)

Ref: Asana 1216667157595351.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Ahmed Abbas

.github/workflows/dep-age-check.yml

@@ -0,0 +1,20 @@
+name: dep-age-check
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  age-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0 # need the base ref to diff lockfiles
+      - uses: convertcom/supply-chain@1e6559ce3128a1c80f2bf5ad780c79ffa75af751 # seed
+        with:
+          # Warn-only for the initial bake; flip to `block` + required check
+          # once we've confirmed no false positives on main.
+          mode: warn

renovate.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>convertcom/supply-chain"]
+}